Chapter 18: Security Configuration Guide
258
DIGITAL GIGAswitch/Router User Reference Manual
You can combine secure port filters with static entries in the following ways:
•
Combine a source secure port filter with a source static entry to drop all received traffic
but allow any frame coming from specific source MAC address to go through
•
Combine a source secure port filter with a flow static entry to drop all received traffic
but allow any frame coming from a specific source MAC address that is destined to
specific destination MAC address to go through
•
Combine a destination secure port with a destination static entry to drop all received
traffic but allow any frame destined to specific destination MAC address go through
•
Combine a destination secure port filter with a flow static entry to drop all received
traffic but allow any frame coming from specific source MAC address that is destined
to specific destination MAC address to go through
To configure Layer-2 secure port filters, enter the following commands in Configure
mode:
Monitoring Layer-2 Security Filters
The GSR provides display of Layer-2 security filter configurations contained in the
routing table.
To display security filter information, enter the following commands in Enable mode.
Configure a source secure port
filter.
filters add secure-port name
<name>
direction source vlan
<VLAN-num>
in-port-list
<port-list>
Configure a destination secure
port filter.
filters add secure-port name
<name>
direction destination vlan
<VLAN-num>
in-port-list
<port-list>
Show address filters.
filters show address-filter
[all-source|all-destination|all-flow]
[source-mac
<MACaddr>
dest-mac
<MACaddr>
]
[ports
<port-list>
] [vlan
<VLAN-num>
]
Show port address lock
filters.
filters show port-address-lock ports
[ports
<port-list>
] [vlan
<VLAN-num>
]
[source-mac
<MACaddr>
]
Show secure port filters.
filters show secure-port
Show static entry filters.
filters show static-entry
[all-source|all-destination|all-flow]
ports
<port-list>
vlan
<VLAN-num>
[source-mac
<MACaddr>
dest-mac
<MACaddr>
]
